Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 09:29

General

  • Target

    1485655eddec3797d0d4e3eac52d11bc.exe

  • Size

    1.0MB

  • MD5

    1485655eddec3797d0d4e3eac52d11bc

  • SHA1

    3a2b3318b5114cd0fac594af6e178eacc8cd3f1e

  • SHA256

    161546849fbffcf6829641f4f44c71739f89144876a684657133f2e6bb2bd140

  • SHA512

    6d4ef5d23f2692a05bb61dcf0e285134d00a20223d49eab599b2fdb558ba57a04b10c005ba6daa9d1dc0ea58573670f154bebdcbc0277aad0eb4d9559c2c18de

  • SSDEEP

    12288:fMiy4IadS4ms5I6e66fEheKhWsTCxef7cXYgvikavS+skI9rvMQQw6t9y8Yon:fbSaE4mvt/bJcjcXYgKzskIG5n

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • NSIS installer 4 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1485655eddec3797d0d4e3eac52d11bc.exe
    "C:\Users\Admin\AppData\Local\Temp\1485655eddec3797d0d4e3eac52d11bc.exe"
    1⤵
    • Checks computer location settings
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2232
    • C:\Users\Admin\AppData\Local\Temp\File.exe
      "C:\Users\Admin\AppData\Local\Temp\File.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2436
      • C:\Users\Admin\AppData\Local\Temp\eicabfiaccj.exe
        C:\Users\Admin\AppData\Local\Temp\eicabfiaccj.exe 6-1-1-1-8-2-1-0-9-3-6 KU9IQzUvMjAuMBopUlRBSEdDPScdKUhEU1ZHUEpJOzoqGi5DSEtSSEQ0LjIvNTIfJ0FIRDQtGilPUU48U0JUVkY+NzIyMS0eLlM8T1A/UV5USko8aGtxajQuLnJqdC1EPFBFJ1NOTyU/T1AlRkhATh8uO0pIQ0JGPjc4UTAoc0N6WEprGi5DMDVMVE05QkwaLkMxNSswICZBLTcsMB8nQjM9JC4aKUM0PCUvHy9HT0k+VEJTV05RSU0+PVM8Hy5IUE5ETEBOWURUSzk7Hy9HT0k+VEJTV0xATTw6GilEV0RXU1FMNB0pP1dEXjtLQ0xASz83Hy5HR1FTXzlPSVFSRFE1MB8vS0U7SEpYTk1dVFJDOhopVUw8Kh4uREouNxouUVRGUkhNPFxRP0tCTkVDSE04RD9PUUs8GC1IU1ZPT0hTSEw9O3NybGIaKVFEU01QTUlFRFlPUkRRV0JAWUo6LBouR0g8Q1c9KB0pQ1JeQ1FMQE1AQFk/TUJRUU5TRTs6YFtrcmQYLUNPTktGSUBDXkFOPDgnKysuLTExJjEwICZRQ0dEPDAsMDc1JzAuLDMfLjxNVk5DTDs+XlNIRUM8NCY1KSwvMDQiMDkzJzcsLilPTA==
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:324
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81704136715.txt bios get serialnumber
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3500
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81704136715.txt bios get version
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4112
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic /output:C:\Users\Admin\AppData\Local\Temp\81704136715.txt bios get version
          4⤵
            PID:1876
          • C:\Windows\SysWOW64\Wbem\wmic.exe
            wmic /output:C:\Users\Admin\AppData\Local\Temp\81704136715.txt bios get version
            4⤵
              PID:3360
            • C:\Windows\SysWOW64\Wbem\wmic.exe
              wmic /output:C:\Users\Admin\AppData\Local\Temp\81704136715.txt bios get version
              4⤵
                PID:1148
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 324 -s 844
                4⤵
                • Program crash
                PID:4548
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 324 -ip 324
          1⤵
            PID:1140

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\81704136715.txt

            Filesize

            66B

            MD5

            9025468f85256136f923096b01375964

            SHA1

            7fcd174999661594fa5f88890ffb195e9858cc52

            SHA256

            d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

            SHA512

            92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

          • C:\Users\Admin\AppData\Local\Temp\81704136715.txt

            Filesize

            2B

            MD5

            f3b25701fe362ec84616a93a45ce9998

            SHA1

            d62636d8caec13f04e28442a0a6fa1afeb024bbb

            SHA256

            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

            SHA512

            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

          • C:\Users\Admin\AppData\Local\Temp\81704136715.txt

            Filesize

            58B

            MD5

            dd876faf0fd44a5fab3e82368e2e8b15

            SHA1

            01b04083fa278dda3a81705ca5abcfee487a3c90

            SHA256

            5602490a82bcacec8797d25cbb6f643fc9e69f89a2f0e6ec1e8d1f568e77a6b9

            SHA512

            e03d1def5b7fb0ed01a414cead199229ec0e153ff831d3ff5dd36c320572084c56a5e1369c753f868c855455758c0d308941b6187c348051419bd937d014cb8b

          • C:\Users\Admin\AppData\Local\Temp\File.exe

            Filesize

            557KB

            MD5

            2bbef6270549cb4505dcb6c2593db77c

            SHA1

            ddce684a1a32fa1bd18c32645851f42756d2b365

            SHA256

            7effe89fb3dcf62ba4b8f17888337e389ce38fe33c821aa4254a81b8ea5e4f8a

            SHA512

            0f6993e4b799922c3abf460b515537dbc52fd6b78535a607a85e0b90b03f13ca4fae9b01e5b0faa80620b70dd5bd6ea49f36f720a0e5b43671a5b4afc868fcff

          • C:\Users\Admin\AppData\Local\Temp\File.exe

            Filesize

            486KB

            MD5

            35b42b4fbe0cc8d76bf876a7dc210b0d

            SHA1

            30e8cd77031e3673cd0405ccaeba1a7dc57ed137

            SHA256

            7b62334b34e009bcffd16df19c2dc0dd945c1d8f2a6abdb62e26ccd13c695a4c

            SHA512

            5d35966458af8ebf684eadc5f2e15ef9a8e0ca1137ec04b04685cff34ab33d83ef3b4759d5466e48c9ded2e2640d9092069f025789a2ff06662afcc50e090aa7

          • C:\Users\Admin\AppData\Local\Temp\eicabfiaccj.exe

            Filesize

            489KB

            MD5

            7c10aee79a20ad5b822f09e196a90f56

            SHA1

            4bfaf86eb075c75a4520366c7c107fb42bbba899

            SHA256

            c082d362a3451a723465dfbd6d01ae8e47a700bc9e289e0fd01a268e8b183f49

            SHA512

            72bcee9140d4aca80d65c0ea69bd27a587695db6e8178fd598ea8564e0c55a1ec21e9036bf13fb03e87d7efe09b3b760416c60171a479d6060a0df82af87bf7c

          • C:\Users\Admin\AppData\Local\Temp\eicabfiaccj.exe

            Filesize

            346KB

            MD5

            22e341b5b537fc1b3f3167479552c801

            SHA1

            3da42f872d00cac7ebeb1b2a6eacb538a3ea3490

            SHA256

            6f166019d6b2533bceb55a8e157cd6991144e00099838a806ca46b80c7c42a8b

            SHA512

            39487241d019cdeaa10d3d1630e05139916a54155d39d30a0a881c8f19f410cc8f15c941a3755d4d0190b60640b0a1282f3a652de3b2a0bbf6aa8a6ef98ecc17

          • C:\Users\Admin\AppData\Local\Temp\nshA5C6.tmp\jnqcc.dll

            Filesize

            125KB

            MD5

            fa201b3a974e89c2698bd733a75f1ca9

            SHA1

            574b335dc91439ecaffaddf305dce5bbfa93cb16

            SHA256

            98ac4f5ba3c5ced121551da176662b0823496058c795b3cdac2291cc2b942ed6

            SHA512

            f7b0b08886d7fd6f1313d8d283e8f5663bd9dd3c59885f8f00de037580475f5a37682dc5a24d5e5ac09c4893dc063e48399d4b5ba248fd085439c0c2651cd09f

          • C:\Users\Admin\AppData\Local\Temp\nshA5C6.tmp\nsisunz.dll

            Filesize

            40KB

            MD5

            5f13dbc378792f23e598079fc1e4422b

            SHA1

            5813c05802f15930aa860b8363af2b58426c8adf

            SHA256

            6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

            SHA512

            9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5

          • memory/2232-0-0x00007FFCF1C80000-0x00007FFCF2621000-memory.dmp

            Filesize

            9.6MB

          • memory/2232-16-0x000000001BC80000-0x000000001BCF8000-memory.dmp

            Filesize

            480KB

          • memory/2232-2-0x0000000000960000-0x0000000000970000-memory.dmp

            Filesize

            64KB

          • memory/2232-1-0x00007FFCF1C80000-0x00007FFCF2621000-memory.dmp

            Filesize

            9.6MB

          • memory/2232-92-0x00007FFCF1C80000-0x00007FFCF2621000-memory.dmp

            Filesize

            9.6MB